Database/Control plane, storage & DevOps
AAP Gateway Operator: resource-server secret copied in plaintext into the AutomationController custom resource
Impact
When the operator reconciles an AutomationController, it copies the Gateway-to-Controller resource-server secret out of its Kubernetes Secret and into spec.extra_settings of the AutomationController custom resource. Anyone who can read that custom resource but not the Secret gets the value, which breaks the RBAC separation between the two. The value can also spread into etcd, GitOps and Argo diffs and history, rendered manifests, support bundles and audit data. With it, a user may impersonate a trusted Controller service and reach privileged service-index APIs.
Who can reach it
An authenticated principal with read access to the AutomationController custom resource on the OpenShift cluster (or to any copy of it, such as GitOps history), over the network.
What to do
Apply the Red Hat Ansible Automation Platform 2 operator update listed in the Red Hat advisory. The record names no fixed version. After upgrading, rotate the resource-server secret, because existing copies in etcd, Git history and support bundles stay exposed. Until then, limit read access to AutomationController custom resources.
References
Related entries
- GitLab: group milestones API returns private-project milestone metadata without membershipCVE-2026-13319 · GitLab CE/EE group milestones API (project filter authorization)Medium
- GitLab CE/EE: malformed CSV import lets an authenticated user stall Sidekiq workersCVE-2026-1403 · GitLab CE/EE (CSV import, Sidekiq worker)Medium
- PostgreSQL pgcrypto: PGP functions emit recoverable cleartext when OpenSSL disables the cipherCVE-2026-14663 · PostgreSQL pgcrypto (pgp_sym_encrypt / pgp_pub_encrypt family)Medium
- Grafana: read-only Git Sync users can change a connection's configuration via its status subresourceCVE-2026-15577 · Grafana Git Sync provisioning (connection status subresource)Medium
- Keycloak: authenticated user can exhaust server memory via unbounded Prometheus metric labelsCVE-2026-16100 · Keycloak (user-event Prometheus metrics)Medium
- Grafana: folder-admin check ignores the folder, exposing deleted dashboards from other foldersCVE-2026-16491 · Grafana RBAC service (folder-admin check ignores the requested folder for deleted dashboards)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.